Rudra Verma
@RudravermaTrusted contributorCompletionist
3 followers269 downloads1,191 copies16 likes20,760 views
108 detections
Filters
Last updated
All Time
Detection languages
108
Categories
27
21
20
16
14
Platforms
61
39
9
7
6
Products / Services
34
18
17
15
4
MITRE Techniques
41
38
36
28
24
CVEs
2
2
1
1
This rule detects potential MFA push fatigue attacks by identifying a high volume of failed multi-factor authentication challenges for a single user within a short time window. It aggregates sign-in logs, specifically looking for result types indicative of MFA failures, and alerts if a user receives more than a defined threshold of MFA challenges within a 30-minute period.
This rule detects a potential quishing (QR code phishing) attack followed by a suspicious successful sign-in to Entra ID (formerly Azure AD). It correlates URL click events or device network events containing deep link indicators (like 'tg://login', 'wa.me/settings/linked_devices', 'signal://', 'line://') or '.apk' file downloads with a successful Entra ID sign-in by the same user within a 30-minute window. This behavior suggests a user may have scanned a malicious QR code, clicked a phishing link, or downloaded a malicious application, leading to a successful but potentially compromised authentication.
This rule detects potential brute force login attempts against Windows systems by monitoring Windows Security Event ID 4625 (failed logon attempts). It aggregates failed attempts by IP address and computer within a 15-minute window and triggers an alert if the number of failed attempts exceeds a defined threshold (default 10). This indicates an adversary systematically guessing passwords to gain unauthorized access.
This rule detects password spraying attacks where a single IP address attempts to authenticate against multiple unique user accounts within a specified time window, resulting in failed sign-in attempts. It specifically looks for a high number of unique users failing authentication from the same IP, which is characteristic of password spraying to avoid account lockouts.
This rule detects when multi-factor authentication (MFA) or strong authentication settings are disabled or removed for a user account. It specifically looks for successful audit log entries related to operations such as 'Disable Strong Authentication', 'Update user', 'Update StsRefreshTokensValidFrom', 'Admin registered security info', or 'Admin deleted security info'. This activity could indicate an adversary attempting to maintain persistent access to a compromised account by weakening its authentication requirements.
This rule detects potential DNS tunneling or data exfiltration by identifying high volumes of DNS queries with unusually long subdomains from a single process on a device. It aggregates DNS connection inspection events, extracts the subdomain length, and then summarizes the count of queries, unique domains, and average subdomain length within a 10-minute window. An alert is triggered if the query count exceeds 100 or if more than 50 unique domains are observed, combined with subdomain lengths greater than 30 characters.
This rule detects high-volume access to Azure Key Vault secrets, keys, or certificates within a one-hour window. It specifically looks for successful read operations on secrets, keys, and certificates, as well as modifications to access policies. A high volume (more than 10 accesses) from a single caller within an hour is flagged as potential credential harvesting.
This rule detects the creation of new local user accounts or the addition of existing accounts to the local Administrators group on Windows systems. It specifically looks for Windows Security Event IDs 4720 (A user account was created) and 4732 (A member was added to a security-enabled local group) or 4728 (A member was added to a security-enabled global group) or 4756 (A member was added to a security-enabled universal group), filtering for 'User' account types and ensuring that for Event ID 4732, the group is the 'Administrators' group (identified by SID S-1-5-32-544 or group name). This activity can indicate an adversary establishing persistence or escalating privileges.
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
This rule detects potential port scanning activity from a single host. It identifies scenarios where a device attempts to connect to a large number of unique remote ports (20 or more) or a large number of unique remote IP addresses (25 or more) within a 10-minute window. This behavior is indicative of an adversary attempting to discover open ports or active hosts on a network.
Page 5 of 11